Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

A company is reviewing the security posture of an internal corporate portal hosted on Amazon EC2 instances in a private subnet. The portal is currently accessed by employees on-premises via an AWS Direct Connect connection and an internal Application Load Balancer (ALB). The business now requires that external strategic partners also access the portal securely over the public internet. These partners authenticate using a third-party SAML 2.0 Identity Provider (IdP). The company must protect the portal against web-based attacks, block malicious traffic at the edge, and enforce SAML-based authentication for external partners, while maintaining direct internal access for employees without sending employee traffic over the internet. Which two actions should the solutions architect take to meet these requirements?

  1. Create an internet-facing ALB in the public subnets. Configure an HTTPS listener on the internet-facing ALB with an authentication action using Amazon Cognito. Configure an Amazon Cognito user pool federated with the partner's SAML 2.0 IdP to authenticate external users before forwarding requests to the target group.Answer
  2. Associate an AWS WAF WebACL containing custom rules and AWS Managed Rules with the internet-facing ALB. Configure the WebACL rule priority to evaluate specific block and rate-limiting rules first, followed by general allow rules.Answer
  3. C
    Associate an AWS WAF WebACL with the internet-facing ALB. Configure the WebACL rule priorities such that general IP-based allow rules are evaluated first to speed up processing of legitimate traffic, followed by specific SQL injection and cross-site scripting (XSS) inspection rules.
  4. D
    Configure an IAM role for partner access with a trust relationship that specifies the SAML IdP as the principal, using the sts:AssumeRole action in the trust policy to allow partner users to federate directly and access the internal application servers.
  5. E
    Configure the Amazon Cognito user pool to encrypt partner profile data using the AWS-managed KMS key for Cognito Identity Pools, and update the policy of this AWS-managed key to grant the partner's external AWS account access to decrypt the data.

Answer

Create an internet-facing Application Load Balancer integrated with Amazon Cognito and a federated SAML user pool for partner authentication, and associate an AWS WAF WebACL with rule priorities configured to evaluate specific block and rate-limiting rules before general allow rules.
The correct solution deploys an internet-facing ALB for partner ingress, integrating Cognito User Pools to offload SAML 2.0 authentication from the backend applications. Security is strengthened by associating AWS WAF with the internet-facing ALB and ensuring specific security blocks and rate limits are evaluated first, blocking threats before they can reach the application or trigger broader allow rules.

Step-by-Step Solution

1
Address network ingress for external users
Deploy an internet-facing ALB in public subnets while keeping the existing internal ALB for on-premises employee access, ensuring internal traffic does not transit the public internet.
This establishes a distinct network path for external partners, separating public internet access from internal Direct Connect paths.
2
Establish SAML-based federated authentication
Configure Cognito User Pools with SAML federation linked to the partner's IdP, and configure ALB listener rules to authenticate requests via Cognito before forwarding them.
Cognito handles the SAML exchange and user authentication at the ALB layer, preventing unauthenticated traffic from reaching backend EC2 instances.
3
Apply edge security protections and rule ordering
Associate an AWS WAF WebACL with the internet-facing ALB. Structure WebACL rules so that rate-limiting, SQL injection, and other block rules run with higher priority (evaluated first) than any general allow rules.
Proper WAF rule ordering prevents malicious traffic from bypassing inspection filters via generic permit statements.

Key Concept

Strengthening public-facing network endpoints through proper WAF rule prioritization, Cognito-integrated ALB authentication with external SAML IdPs, and segregation of internal and external traffic paths.
Rate this question

Topics

Strengthening Identity, Access, and Network Security